1. Field of the Invention
The present invention relates to electronic mail. More specifically, the present invention relates to a method and an apparatus for digitally signing electronic mail that originates from a web browser.
2. Related Art
In addition to providing an effective means of communication, people are beginning to use electronic mail for other purposes, such as consummating business transactions. To provide an effective medium for business transactions, electronic mail needs to be signed in a manner that makes it possible to verify the source of the electronic mail and that facilitates non-repudiation of electronic mail messages.
Existing applications that send and receive electronic mail sometimes include cryptographic processes for embedding digital signatures within the email message. These applications typically use a mail format known as Secure Multipurpose Internet Mail Extensions (S/MIME) to encapsulate a number of items including, the message, addressing information, digital signatures, and other information related to the electronic mail message. While this system works well when the electronic messages originate from and are delivered to electronic mail applications, there are many situations in which generating an S/MIME formatted message is not possible or presents security problems.
Problems can arise while accessing electronic mail from a remote location, because such access may be prohibited by corporate firewalls or may be restricted by other means. In these cases, users can retrieve their electronic mail from a web mail server through a web browser. While a web browser can access the web mail server to perform a number of functions, such as displaying messages, replying to messages, and initiating new messages, existing web browsers do not have the capability to create an S/MIME formatted message. The web mail server typically formats and deformats electronic mail messages for the web browser using the Multipurpose Internet Mail Extensions (MIME) standard.
A web mail server can be programmed to generate S/MIME messages. However, this creates security problems. In order for the web mail server to be able to sign the message, the web mail server needs to know the signer's private key. If the signer's private key is available to an application such as the web mail server, the signature cannot be traced reliably to the user. Therefore, the user can deny signing a message and there would be no proof to indicate otherwise.
Hence, what is needed is a method and an apparatus for digitally signing browser electronic mail without the problems described above.